TOOLS-136: Support remote HTTPS OAuth callbacks

[averycrespi]

Context

Implements TOOLS-136: complete upstream OAuth from a remote browser behind an HTTPS reverse proxy without an SSH tunnel.

Stacked on #165, targeting avery/tools-135-remote-serving rather than main. Incremental base: a2c70776b2c85838ffea3bb28460a6b77be48f6f.

Changes

• Default OAuth redirect to the configured external HTTPS origin plus /oauth/callback, reusing the main listener and preserving exact redirect bytes throughout registration, authorization and exchange.
• Require remote callback overrides to match that exact URI; retain local loopback callback listeners without external origin. Reject malformed callback paths/bodies and preserve Host/forwarding/state/PKCE/issuer/fencing/no-replay controls.
• Advertise web clients for HTTPS dynamic registration; update UI/API validation and operator documentation without claiming universal provider acceptance.
• Add deterministic HTTPS provider/reverse-proxy coverage, callback negatives, cancel/restart and installed-credential MCP use.

Review Notes

Review the incremental diff from #165; tests exercise the cumulative tree. Private HTTPS MCP upstream policy is intentionally unchanged (TOOLS-137). The fixture proves usable installed encrypted OAuth credentials with the existing test-only resolver/dial seam after stopped generation read; it does not claim running-Gateway private-upstream support.

No real provider credentials, live installation, Docker build/runtime, deployment or registry publication are involved. Provider-specific registration acceptance remains separate qualification.

Test Plan

Passed locally:

• Race/count-one tests: contract, OAuth, servers, API, HTTP boundary, CLI root and composition
• Real-binary E2E: remote HTTPS OAuth, preserved loopback OAuth, remote serving/local CLI
• make -C agent-gateway verify, test-security and test-harness (including documentation/link checks)
• Frontend typecheck, deterministic generated assets, supply-chain guard and 187 Node tests
• Full mocked Chromium suite (31 scenarios), real-Gateway Chromium accessibility, and actual desktop/mobile/320px callback-state screenshot inspection
• npm run format:check

Exact-head target-applicable CI is required before draft promotion.